PRIVACY POLICY
AUXILIUM CONSULTORUM (PTY) LTD t/a AUXCON
Registration number: 2011/148303/07
257 Brooklyn Road, Brooklyn, Pretoria, 0181
(“Auxcon”)
Protection of Personal Information Act 4 of 2013 (POPIA)
Information Officer: Leigh-Ann Fourie · leigh-ann@auxcon.co.za · +27 61 231 4070
Effective Date: 1 October 2026Version: v3.0
1.INTRODUCTION AND ABOUT AUXCON
1.1Auxilium Consultorum (Pty) Ltd, trading as Auxcon ("Auxcon", "we", "us" or "our"), develops software and owns software products for the South African legal industry. Auxcon provides billing, invoicing, reconciliation and debtor-administration services to Advocates.
1.2Auxcon owns and operates AuxAttorney, a digital briefing platform that enables Attorneys in South Africa to send electronic briefs to Advocates. Auxcon also owns and operates AuxGenie, the companion mobile application and web portal for Advocates. Together AuxAttorney and AuxGenie form AuxBrief, Auxcon's digital briefing system. Auxcon also provides the Practice Management Service to Advocates who subscribe to the AuxPractice tier, with Invoice Assistant, Reconciliation, Debtor Management and Ad hoc Debt Collections available as separately charged add-on services.
1.3Auxcon is committed to protecting the privacy of its Customers, Users and Advocates. It processes Personal Information in accordance with the Protection of Personal Information Act 4 of 2013 ("POPIA”) and, where applicable, the Consumer Protection Act 68 of 2008 (“CPA"). Auxcon undertakes to apply the eight conditions for lawful processing set out in Chapter 3 of POPIA—accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards and Data Subject participation—in the manner described in section 6.
1.4Auxcon acts as the Responsible Party for Personal Information it collects directly from Customers, Users and Advocates, and as an Operator for Matter Data processed on a Customer’s documented instructions. Auxcon has designated an Information Officer. Personal Information processed on the Platform is stored in the Republic of South Africa. Data Subjects may exercise their rights under POPIA and lodge complaints with the Information Regulator; requests for access to records may also be made under PAIA. This Privacy Policy explains in plain language how Auxcon collects, uses, stores, shares and protects Personal Information when you use the Platform.
2.SCOPE AND APPLICATION
2.1This Privacy Policy applies to:
2.1.1the Auxcon corporate websites at ww2.auxcon.co.za and https://auxattorney.com;
2.1.2the AuxAttorney digital briefing platform;
2.1.3the AuxGenie companion application and Advocate Web Application;
2.1.4the Practice Management Service (billing, invoicing, reconciliation and debtor administration), including communications with Auxcon's practice management team;
2.1.5all interactions between Auxcon and its Customers, Users, and Advocates in connection with the above.
2.2This Privacy Policy should be read together with Auxcon's Standard Terms of Service and, where applicable, the relevant SaaS Agreement.
3.DEFINITIONS
3.1In this Privacy Policy, unless the context requires otherwise:
3.1.1"Advocate" means a legal practitioner admitted and enrolled as an advocate who has registered on AuxGenie under the Advocates SaaS Agreement;
3.1.2"Attorney" means a legal practitioner admitted as an attorney who practises within a Customer;
3.1.3“Constituent Bar” means a Bar Society that is a constituent member of the GCB;
3.1.4“CPA” means the Consumer Protection Act 68 of 2008;
3.1.5"Customer" means an attorney firm or legal practice that has entered into the Attorneys SaaS Agreement with Auxcon;
3.1.6"Data Subject" means the person to whom Personal Information relates, as defined in POPIA;
3.1.7“Days” means calendar days, unless otherwise stated.
3.1.8"De-identified Data" means data from which all information that identifies, or could reasonably be used to identify, a Data Subject, a client, a Matter or the content of Matter Data has been removed, and which cannot reasonably be re-identified;
3.1.9“Defaulters List” means the electronic list hosted and maintained by Auxcon on behalf of the GCB, recording law firms that have failed to pay Advocates’ fees, access to which is restricted to the GCB and its Members;
3.1.10“GCB” means the General Council of the Bar of South Africa;
3.1.11"Industry Payment Reports" means the reports made available to Advocates on the Platform which show, for each law firm named in them, indicators of that firm's payment performance derived from payments reconciled on the Platform against Advocates' invoices, as described in clause 12.5;
3.1.12"Information Officer" means the person designated by Auxcon to perform the responsibilities set out in POPIA, whose contact details appear in this Privacy Policy;
3.1.13“LPC” means the Legal Practice Council established under the Legal Practice Act 28 of 2014;
3.1.14“Matter” means a legal matter created by an Attorney in AuxAttorney to which documents, instructions and briefs are linked, and in respect of which an Advocate may be briefed or appointed;
3.1.15“Matter Data” means documents, information and data relating to a Matter uploaded to the Platform by a Customer, including Personal Information about clients, opposing parties and other third parties;
3.1.16“Member” means a practising Advocate who is a member of a Constituent Bar of the GCB;
3.1.17"Operator" means a person who processes Personal Information for a Responsible Party in terms of a mandate or agreement, without coming under the direct authority of that Responsible Party, as defined in section 1 of POPIA;
3.1.18“PAIA” means the Promotion of Access to Information Act 2 of 2000;
3.1.19"Personal Information" has the meaning given in section 1 of POPIA and includes information relating to an identifiable, living natural person and, where applicable, an identifiable, existing juristic person;
3.1.20"Platform" means, collectively, the Auxcon websites, AuxAttorney, AuxGenie, the Advocate Web Application and the Practice Management Service;
3.1.21"POPIA" means the Protection of Personal Information Act 4 of 2013;
3.1.22"Processing" has the meaning given in section 1 of POPIA and includes any operation or activity concerning Personal Information;
3.1.23“Regulatory Body” means the GCB, a Constituent Bar, the LPC or another statutory or professional body with jurisdiction over an Advocate, Attorney or legal practice;
3.1.24"Responsible Party" means a public or private body or any other person which, alone or in conjunction with others, determines the purpose of and means for processing Personal Information, as defined in section 1 of POPIA;
3.1.25“SaaS Agreement” means the Attorneys SaaS Agreement or the Advocates SaaS Agreement, as applicable;
3.1.26"Special Personal Information" means Personal Information described in section 26 of POPIA, including information concerning race or ethnic origin, religious or philosophical beliefs, trade-union membership, political persuasion, health or sex life, biometric information, and criminal behaviour;
3.1.27“Standard Terms of Service” means Auxcon’s standard terms governing access to and use of the Platform;
3.1.28"Subscriber" means a Customer or an Advocate;
3.1.29"User" means any natural or juristic person who accesses or uses the Platform in any capacity;
4.OUR ROLES: RESPONSIBLE PARTY AND OPERATOR
4.1Responsible Party: Auxcon acts as the Responsible Party, as defined in POPIA, for Personal Information it collects directly from Customers, Users and Advocates for account management, billing, platform administration and service delivery. For Advocates, this includes identity and contact details, chambers, seniority, fields of practice, banking details, bank statements uploaded for reconciliation, invoice and payment records, and communications with the practice management team.
4.2Operator: Auxcon acts as the Operator, as defined in POPIA, for Matter Data that Customers upload as part of their client data, including information about clients, opposing parties and matters. Auxcon processes Matter Data only on the Customer’s documented instructions. The Customer remains the Responsible Party for that Matter Data.
4.3Where Auxcon acts as an Operator, the Customer is responsible for ensuring that it has obtained all necessary consents and other lawful authorisations from Data Subjects before uploading Personal Information to the Platform.
4.4Practice Management Service: Where an Advocate mandates Auxcon to provide billing, invoicing, reconciliation, debtor-administration or debt-collection services, the Advocate determines the purpose and means of that processing and is the Responsible Party for it. Auxcon acts as the Operator and processes the Advocate's fee, invoice, client and payment information only on the Advocate's instructions, including when corresponding with debtor firms in the Advocate's name and when providing a firm with a statement of its account under clause 12.1.7. This does not affect Auxcon's role as Responsible Party under clause 4.1 for its own account, subscription and billing relationship with the Advocate.
4.5GCB Defaulters List: To the extent Auxcon hosts or maintains the Defaulters List on behalf of the GCB, the GCB, or the relevant Constituent Bar where applicable, determines the purposes and means of processing the listing data and is the Responsible Party. Auxcon acts as the Operator and system provider, processes the listing data only on documented instructions, and performs the services in accordance with the service level agreement between Auxcon and the GCB.
5.INFORMATION OFFICER AND REGULATOR CONTACT DETAILS
5.1Auxcon's designated Information Officer may be contacted at the following details:
| Detail | Contact |
|---|---|
| Information Officer | Leigh-Ann Fourie |
| leigh-ann@auxcon.co.za | |
| Telephone | +27 61 231 4070 |
| Postal Address | 257 Brooklyn Road, Brooklyn, Pretoria, 0181 |
| Entity | Auxilium Consultorum (Pty) Ltd t/a Auxcon |
5.2Auxcon has designated an Information Officer and has registered her with the Information Regulator in accordance with section 55 of POPIA and the Regulations. The Information Officer oversees Auxcon's compliance with POPIA and this Privacy Policy.
5.3The Information Regulator may be contacted at the following details:
| Detail | Contact |
|---|---|
| Website | www.inforegulator.org.za |
| Physical address | JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 |
| Telephone | 010 023 5200 |
| enquiries@inforegulator.org.za | |
| Complaints | POPIAComplaints@inforegulator.org.za (POPIA) · PAIAComplaints@inforegulator.org.za (PAIA) |
6.THE EIGHT POPIA CONDITIONS FOR LAWFUL PROCESSING
6.1To the extent Auxcon acts as a Responsible Party, it undertakes to apply the following eight conditions for lawful processing set out in Chapter 3 of POPIA. This undertaking is subject to the nature and purposes of the relevant processing, applicable law and the documented instructions of the relevant Responsible Party where Auxcon acts as an Operator:
6.1.1Accountability (Condition 1): Auxcon undertakes to maintain appropriate governance and oversight for its processing of Personal Information and to designate an Information Officer to oversee data-protection compliance.
6.1.2Processing Limitation (Condition 2): Auxcon undertakes to process Personal Information only for a specific, explicitly defined and lawful purpose, only where a lawful basis under section 11 of POPIA applies, and only to the extent reasonably necessary for that purpose.
6.1.3Purpose Specification (Condition 3): Auxcon undertakes to collect Personal Information for specific, explicitly defined and lawful purposes and to tell Data Subjects what those purposes are through this Privacy Policy or another lawful notice.
6.1.4Further Processing Limitation (Condition 4): Auxcon undertakes to assess any further processing against the original purpose and to avoid further processing that is incompatible with that purpose, unless POPIA permits it.
6.1.5Information Quality (Condition 5): Auxcon undertakes to take reasonable steps to ensure that Personal Information is complete, accurate, not misleading and updated where necessary.
6.1.6Openness (Condition 6): Auxcon undertakes to provide clear information about its processing of Personal Information through this Privacy Policy and other notices required by law.
6.1.7Security Safeguards (Condition 7): Auxcon undertakes to implement and maintain appropriate technical and organisational measures to protect Personal Information against loss, damage, unauthorised access, unlawful processing and unauthorised destruction.
6.1.8Data Subject Participation (Condition 8): Auxcon undertakes to provide reasonable mechanisms for Data Subjects to request access to, correction of or deletion of their Personal Information, subject to applicable law and the rights of others.
6.2Auxcon’s undertaking in this section is subject to the nature and purposes of the relevant processing, the information reasonably available to Auxcon, applicable law and the documented instructions of the relevant Responsible Party. Nothing in this section is an absolute warranty that every risk can be eliminated.
7.CATEGORIES OF PERSONAL INFORMATION WE PROCESS
7.1Auxcon collects and processes the following categories of Personal Information:
7.1.1Customer and User Information: full names, identity numbers (where required for verification), e-mail addresses, telephone numbers, Legal Practice Council (LPC) registration numbers, firm names, account credentials and billing details.
7.1.2Matter Data: Personal Information about a Customer's clients, opposing parties and other third parties uploaded by the Customer in managing Matters on AuxAttorney. The Customer is the Responsible Party for this data; Auxcon acts as Operator only on the Customer's documented instructions.
7.1.3Advocate Information: names, contact details, chambers, seniority, fields of practice, gender and race (for briefing-filter purposes only—see section 8), banking details, and bank statements uploaded for reconciliation through AuxGenie and the Advocate Web Application.
7.1.4Practice Management Communications: fee narrations, time entries, instructions, documents and messages sent to Auxcon's practice management team by Advocates who subscribe to the Invoice Assistant add-on, including WhatsApp messages and voice notes and e-mails.
7.1.5Briefing and Payment Records: Brief Requests, responses, Appointments, invoices delivered into Live Statements, and payment and reconciliation records, from which Auxcon also derives De-identified Data (see clause 12.3).
7.1.6Payment Performance Information: for each law firm invoiced through the Platform, the firm's name, the dates of Advocates' invoices and the dates on which payments are reconciled against them, the resulting days-to-payment figures and, for Members, the number of Defaulters List listings and LPC complaints recorded on the Platform against the firm. This information is compiled into Industry Payment Reports (see clause 12.5).
7.1.7WhatsApp Data: an Advocate’s mobile number; message content (outbound notification templates and, for Invoice Assistant subscribers, inbound messages and voice notes to the practice management team); message delivery metadata, including status and timestamps; and opt-in and opt-out records. Meta Platforms Inc. processes message data under Meta's Privacy Policy (https://www.facebook.com/privacy/policy/). Auxcon does not currently send WhatsApp notifications to Attorneys.
7.1.8Technical Data: IP addresses, browser types and versions, operating systems, device identifiers, pages visited, links clicked, usage patterns and WhatsApp message delivery metadata.
7.1.9Server and Access Logs: server-side logs that record API requests, response times, error codes and system events for security and debugging purposes.
8.SPECIAL PERSONAL INFORMATION AND CHILDREN'S INFORMATION
8.1Special Personal Information: Auxcon may process an Advocate’s gender and race information only for the briefing-filter function on AuxAttorney, to support lawful transformation and empowerment objectives in the legal profession. Race information is Special Personal Information under section 26 of POPIA. Because gender and race filters are sensitive, Auxcon applies the safeguards in sections 26 and 27 to both categories and does not use them for unrelated purposes.
8.2The relevant lawful basis for processing this information is:
8.2.1section 29(b) of POPIA, because the briefing filters give effect to laws and measures designed to protect or advance persons disadvantaged by unfair discrimination, including the transformation objectives of the Legal Practice Act 28 of 2014 and the Legal Sector Code;
8.2.2the Advocate’s specific, informed and voluntary consent, obtained before collection or use in terms of section 27(1)(a) of POPIA, unless an applicable exception in section 27 applies;
8.2.3where applicable, the processing is necessary for establishing, exercising or defending a right or obligation in law, in terms of section 27(1)(d) of POPIA; and
8.2.4where another exception in section 27(1) or section 27(2) of POPIA applies. In all cases, the information is used only to facilitate lawful transformation and empowerment objectives under PEPUDA and the briefing-filter function, and not for unrelated purposes or unfair discrimination.
8.3Use of gender and race information is limited to the briefing-filter function. Providing this information is optional; an Advocate may decline to provide it or withdraw consent, and the Platform will not deny access to core functionality solely for that reason.
8.4Children's Information: The Platform is not directed at children under 18. Auxcon does not knowingly collect Personal Information from children. If Auxcon becomes aware that a child's Personal Information was collected without appropriate consent, it will take reasonable steps to delete it as soon as reasonably practicable, subject to any legal retention obligation.
9.LAWFUL BASIS FOR PROCESSING
9.1In terms of section 11 of POPIA, Auxcon processes Personal Information on the following lawful bases, as applicable to the relevant processing:
| Lawful Basis | Description |
|---|---|
| Contract performance (s11(1)(b)) | To provide the Platform and related services, process subscription billing, manage accounts, and facilitate briefs between Attorneys and Advocates. |
| Legitimate interest (s11(1)(f)) | To check the public LPC roll when a practitioner registers, improve the Platform, prevent fraud, maintain platform security, and conduct analytics, where Auxcon’s legitimate interests are not overridden by the rights of the Data Subject. |
| Legitimate interest (s11(1)(f)) | To compile Industry Payment Reports of law firms' payment performance on Advocates' invoices and make them available to Advocates, in the legitimate interests of Advocates, the Constituent Bars and the profession in the timely payment of Advocates' fees, which the LPC Code of Conduct requires attorneys to pay (see clause 12.5). |
| Consent (s11(1)(a)) | To send WhatsApp notifications and marketing communications only where the Data Subject has given the required consent; consent may be withdrawn at any time. |
| Legal obligation (s11(1)(c)) | To comply with applicable requirements of SARS, the Companies Act, the LPC, the GCB and Constituent Bars, court orders, and other legal obligations. |
| Operator processing (s21) | To process Matter Data only on the Customer's documented instructions as Operator under POPIA; the Customer remains the Responsible Party and must identify the relevant section 11 basis. |
| Legal obligation and legitimate interest (s11(1)(c) and s11(1)(f) of POPIA) | To disclose limited information to the GCB, relevant Constituent Bars and the LPC for the GCB Defaulters List and related professional-conduct complaints, where necessary to comply with an applicable legal or regulatory obligation and/or to pursue the legitimate interests of the relevant Regulatory Body and the Advocate or Member in regulating legal practitioners and recovering Advocates’ fees. Disclosures are limited to what is reasonably necessary, and any listing request must be submitted in accordance with the applicable rules and SaaS Agreement. |
10.PURPOSES OF PROCESSING
10.1Auxcon processes Personal Information for the following purposes:
10.1.1Service delivery: to create and maintain accounts, provide the Practice Management Service (including capturing fees, preparing invoices and statements and following up unpaid invoices for Advocates who subscribe to the Invoice Assistant, Reconciliation, Debtor Management or Ad hoc Debt Collections add-ons, on their mandate), and process briefs delivered to Advocates by Attorneys through AuxAttorney.
10.1.2Registration checks: to check the public LPC roll when a practitioner registers.
10.1.3Billing and subscription management: to process payments, manage subscriptions and free periods, and send billing confirmations for subscription fees, seat fees and brief fees.
10.1.4Communications: to send transactional e-mails, including e-mails for account verification, access control, password resets, subscription confirmations and support communications.
10.1.5Product improvement: to improve the performance, quality and user experience of the Platform using analytics and usage data, where permitted by law, and to produce De-identified Data as described in clause 12.3.
10.1.6Security: to detect, prevent and respond to security incidents, fraud and unauthorised access.
10.1.7Legal compliance: to comply with applicable laws, statutes, regulations and court orders, and to respond to lawful third-party requests.
10.1.8Briefing facilitation: to facilitate the matching and briefing of Advocates by Attorneys, including optional briefing filters for court or location, field of practice, seniority, gender and race.
10.1.9Industry Payment Reports: to compile and make available to Advocates reports of law firms' payment performance on Advocates' invoices, as described in clause 12.5.
11.HOW WE COLLECT PERSONAL INFORMATION
11.1Auxcon collects Personal Information through the following means:
11.1.1Directly from you: when you register on the Platform, complete your profile, submit billing information, upload documents or bank statements, send instructions to the practice management team, or communicate with us by e-mail or through support channels.
11.1.2From a Customer: where a firm registers its own Authorised Users, uploads Matter Data or invites an Advocate to register.
11.1.3Automatically: through cookies, server logs and technical monitoring tools when you interact with the Platform (see clause 19, Cookie Policy).
11.1.4From third-party sources: the LPC, to verify practitioner status; Meta Platforms, for WhatsApp delivery metadata; payment service providers, to confirm payments; and accounting, practice-management and document systems that a Subscriber elects to connect to the Platform.
11.2Except for fields identified as optional, the Personal Information Auxcon requests is required to register, authenticate and administer your account, provide the Platform, process payments or comply with law. If you do not provide required information, Auxcon may be unable to create or maintain your account or provide the relevant services. Providing gender, race or direct-marketing preferences is optional, and declining them does not affect core Platform functionality.
12.SHARING AND DISCLOSURE
12.1Auxcon does not sell Personal Information. It shares Personal Information only in the following circumstances:
12.1.1Within the AuxAttorney Platform: brief information is shared with Advocates through AuxGenie when a brief is issued. Documents are accessible to an Advocate only after the Attorney confirms the appointment. Advocate invoices generated through the Advocate Web Application and AuxGenie are delivered to the Attorney’s Live Statement and the relevant Matter’s Invoices tab in AuxAttorney.
12.1.2Practice Management Service: Personal Information required to provide billing, invoicing, reconciliation and debtor-administration services is processed internally by Auxcon's practice management team, which may communicate with debtor firms in the Advocate's name on the Advocate's mandate. This includes tariffs and bank-account details of legal practitioners.
12.1.3Third-party Operators and sub-processors: cloud-hosting providers, including Microsoft Azure; a third-party payment service provider for subscription billing; e-mail delivery services; Meta Platforms Inc. for WhatsApp; and accounting, practice-management and document systems that a Subscriber elects to connect, which act on the Subscriber's instruction. A current, named list of providers is published on the Website and updated when a provider changes. Auxcon requires these providers to use appropriate security measures and to process Personal Information only under written data-processing or Operator agreements and documented instructions appropriate to their role.
12.1.4Legal disclosures: where required or authorised by applicable law, a court order, the LPC, SARS, the South African Police Service or the Information Regulator.
12.1.5GCB Defaulters List and Regulatory Body disclosures: Where a User is a legal practitioner, Auxcon may disclose limited Personal Information—namely the identifying details of a defaulting law firm, the relevant Advocate or Member, and particulars of the outstanding invoice(s), letter of demand and non-payment—to the GCB, the relevant Constituent Bar and the LPC for the GCB Defaulters List and related professional-conduct complaints. The disclosure is made on a valid listing request submitted by the relevant Advocate, Member or Constituent Bar under the applicable rules and SaaS Agreement; Auxcon acts as the system provider and does not initiate the listing. The processing relies on section 11(1)(c) of POPIA to the extent necessary to comply with an applicable legal or regulatory obligation and section 11(1)(f) to the extent necessary for the legitimate interests of the relevant Regulatory Body and the Advocate or Member in regulating legal practitioners and recovering Advocates’ fees. It is limited to information reasonably necessary for those purposes, and access to the Defaulters List is restricted to the GCB and its Members.
12.1.6Auxcon will process a listing request only after the relevant GCB or Constituent Bar has verified it in accordance with its rules, and will support correction or removal of a listing on instruction from the GCB, relevant Constituent Bar or listing Member, including where the outstanding fees have been paid.
12.1.7Account statements to law firms: Where an Advocate has mandated Auxcon to provide billing, invoicing, reconciliation or debtor-administration services, Auxcon may, on request by a law firm to which that Advocate has issued invoices, provide the firm with a statement of its account. The statement is limited to invoices issued to the requesting firm by Advocates who have mandated Auxcon, and the payments and balances relating to them, and does not include information about any other firm or about an Advocate's other clients or matters. Auxcon provides the statement only where it is satisfied that the person requesting it is authorised to act for the firm. Auxcon acts on the mandate of the relevant Advocate, who remains the Responsible Party for the Advocate's invoice and fee information; the firm's own account information is the firm's Personal Information and is disclosed to it as the Data Subject concerned. A firm need not be a Customer or hold an Attorneys SaaS Agreement to request a statement.
12.2Auxcon requires all third-party Operators to implement appropriate security measures and to process Personal Information only on the documented instructions of the relevant Responsible Party.
12.3De-identified Data: Auxcon derives De-identified Data from Platform usage, briefing, invoicing, reconciliation and payment activity, including statistics on briefing patterns, response times, fee levels, payment behaviour and industry trends. De-identified Data does not identify, and cannot reasonably be used to identify, any User, client, Matter or Data Subject, or the content of any Matter Data. Information that identifies a law firm, including its payment performance shown in Industry Payment Reports, is not De-identified Data; see clause 12.5.
12.4Auxcon uses De-identified Data for product improvement, industry research, benchmarking and reporting, and may share it with Regulatory Bodies and commercial partners. Because it has been de-identified to the standard in section 6(1)(b) of POPIA, De-identified Data is not Personal Information. Auxcon does not attempt to re-identify De-identified Data and contractually prohibits recipients from doing so.
12.5Industry Payment Reports: Auxcon records the date on which each Advocate's invoice is paid, as reflected on the Advocate's bank statement and reconciled against the invoice on the Platform, and compiles from these records a payment record for each law firm, showing the average number of days the firm takes to pay Advocates' invoices and the number of invoices paid. Only reconciled payments are included; unpaid invoices are not. Industry Payment Reports display payments reconciled during the preceding 5 (five) years. They are made available to Advocates on the Platform and not to law firms, and identify the firm but not the Advocates concerned. Where an Advocate is a Member, the record also shows the number of Defaulters List listings and LPC complaints recorded against the firm on the Platform.
12.6Auxcon is the Responsible Party for this processing. Its lawful basis is section 11(1)(f) of POPIA: the processing is necessary for the legitimate interests of Advocates, the Constituent Bars and the legal profession in the timely payment of Advocates' fees, which paragraph 18.18 of the LPC Code of Conduct requires attorneys to pay, and those interests are not overridden by the interests of the law firm, which is itself a regulated legal practice subject to that duty. Law firms are notified of this processing in the Attorneys SaaS Agreement, in this Privacy Policy and in the notice included in every invoice e-mail sent to a firm through the Platform.
12.7A law firm may query or request correction of its payment record, or object to the processing on reasonable grounds relating to its particular situation under section 11(3) of POPIA, by writing to the Information Officer at leigh-ann@auxcon.co.za. Auxcon will respond within 30 (thirty) Days. Industry Payment Reports do not involve automated decision-making with legal effect; any decision whether to accept a brief is taken by the Advocate.
13.CROSS-BORDER TRANSFERS
13.1Personal Information processed on the Platform, including Matter Data and backups, is stored in Microsoft Azure data centres located in the Republic of South Africa.
13.2Where Auxcon transfers Personal Information to a third party outside the Republic of South Africa, it undertakes to take reasonable steps to ensure that the transfer is permitted by section 72 of POPIA. A transfer may occur only where at least one of the following applies:
13.2.1the recipient is subject to a law, binding corporate rules or binding agreement that provides an adequate level of protection;
13.2.2the Data Subject has consented to the transfer;
13.2.3the transfer is necessary for the performance of a contract between the Data Subject and Auxcon or for the implementation of pre-contractual measures taken at the Data Subject’s request;
13.2.4the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the Data Subject between Auxcon and a third party; or
13.2.5the transfer is for the benefit of the Data Subject, it is not reasonably practicable to obtain consent, and Auxcon has reasonable grounds to believe that the Data Subject would have consented if it had been practicable to obtain consent.
13.3Where Auxcon acts as an Operator, it will not transfer Matter Data outside the Republic of South Africa without the Customer’s prior written consent, unless the transfer is permitted under section 72 of POPIA and the applicable SaaS Agreement. Operator agreements with cross-border service providers will include appropriate data-protection clauses.
14.SECURITY SAFEGUARDS
14.1In accordance with section 19 of POPIA, Auxcon undertakes to implement and maintain reasonable technical and organisational measures, taking account of generally accepted security practices, the nature and scope of the processing, the risks to Data Subjects, and the cost and technical feasibility of the measures, to protect Personal Information against loss, damage, unauthorised destruction, unlawful access or processing:
14.1.1encryption of data in transit using TLS 1.2 or higher;
14.1.2role-based access controls and least-privilege principles;
14.1.3multi-factor authentication available for all User accounts;
14.1.4regular security assessments, vulnerability scans and penetration testing;
14.1.5secure software-development practices and code-review processes;
14.1.6physical security controls at data centre facilities; and
14.1.7staff training on data protection and information security.
14.2Auxcon reviews and, where reasonably necessary, updates its security measures to address evolving threats and vulnerabilities.
14.3Auxcon maintains access controls, confidentiality obligations and incident-response procedures appropriate to the categories of Personal Information it processes and reviews them periodically.
15.DATA BREACH NOTIFICATION
15.1If Auxcon becomes aware of a security compromise that has resulted in or is reasonably likely to result in unauthorised access to or acquisition of Personal Information, Auxcon will assess the compromise and act in accordance with section 22 of POPIA. Where the compromise presents a real risk of harm to a Data Subject, Auxcon will:
15.1.1notify the Information Regulator as soon as reasonably possible after discovering the compromise;
15.1.2notify affected Data Subjects as soon as reasonably possible, unless their identities or contact details cannot be established, and provide enough information for them to take protective measures;
15.1.3describe the nature of the compromise, the categories of Personal Information concerned, and the measures Auxcon has taken or proposes to take; and
15.1.4provide recommendations for measures that Data Subjects can take to mitigate possible adverse effects.
15.2Where Auxcon acts as an Operator for Matter Data, Auxcon will notify the affected Customer without unreasonable delay and, in any event, within 72 hours after becoming aware of an actual or suspected security compromise affecting Matter Data, so that the Customer can assess its own notification obligations under POPIA.
15.3Auxcon will reasonably cooperate with the affected Customer and the Information Regulator in investigating and remedying a notifiable security compromise, subject to confidentiality, privilege and applicable law.
16.RETENTION OF PERSONAL INFORMATION
16.1Auxcon retains Personal Information only for as long as necessary for the purposes for which it was collected or as required by law. The following retention periods apply:
| Category of Information | Retention Period |
|---|---|
| Customer and User accounts | Duration of Agreement plus 5 years |
| Matter Data (Auxcon as Operator) | Available for export for 30 Days after termination of the Customer's SaaS Agreement, then securely deleted, subject only to a legal hold notified by the Customer or a retention obligation binding on Auxcon |
| Brief, Appointment and invoice transaction records (Auxcon as Responsible Party for its own business records) | 5 years from the end of the tax year in which the record arises |
| Invoices, accounts, and financial data of legal practitioners | 5 years from the invoice date (generated through the Practice Management Service) |
| Subscription billing records | 5 years from the invoice date (SARS and Companies Act requirements) |
| Server and access logs | 12 months |
| Practice management communications (messages, voice notes and e-mails) | 12 months after the related fee entry is invoiced, then deleted |
| WhatsApp notification logs | 30 Days from the message date |
| Marketing consent records | Until consent is withdrawn or 3 years of inactivity |
| De-identified Data | Indefinitely; it does not identify any Data Subject |
| Payment Performance Information (Industry Payment Reports) | Displayed for 5 (five) years from the reconciled payment date; underlying records are retained as Briefing and Payment Records above |
| Defaulters List and listing data | Retained for the duration of the Auxcon–GCB service level agreement. The GCB retains ownership of listing data; on termination, it is returned to or deleted on the GCB’s instruction. Auxcon retains only anonymised industry-trend statistics that do not identify any Data Subject. |
16.2On termination of a Customer's SaaS Agreement, Matter Data is available for export for 30 (thirty) days and is then securely and irreversibly deleted from Auxcon's systems, subject to any legal retention obligation.
16.3Where Personal Information is no longer required and no legal obligation requires its retention, Auxcon securely destroys or de-identifies it in accordance with its internal data-disposal procedures.
17.DATA SUBJECT RIGHTS
17.1Under POPIA, Data Subjects have the following rights in relation to their Personal Information:
17.1.1Right of access (section 23): You have the right to ask whether Auxcon holds Personal Information about you and to request access to or a copy of that information, subject to POPIA’s limitations.
17.1.2Right to correction (section 24): You have the right to request correction, completion, updating or deletion of Personal Information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained.
17.1.3Right to deletion (section 24): You may request the destruction or deletion of Personal Information that Auxcon is no longer authorised or required to retain, subject to any lawful retention obligation.
17.1.4Right to object (section 11(3)): You have the right to object to the processing of your Personal Information on reasonable grounds relating to your particular situation, unless legislation provides for the processing.
17.1.5Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before the withdrawal.
17.1.6Right not to be subject to automated decision-making (section 71): You have the right not to be subject to a decision based solely on automated processing that produces legal effects or significantly affects you.
17.1.7Right to lodge a complaint (section 74): You have the right to lodge a complaint with the Information Regulator if you believe that your rights under POPIA have been infringed.
17.1.8Right to privacy (section 5): You have the right to privacy, including the right not to have your Personal Information processed in contravention of POPIA.
17.2How to exercise these rights:
17.2.1Submit a written request to the Information Officer at leigh-ann@auxcon.co.za. Include enough information to identify yourself and describe the right you wish to exercise.
17.2.2Auxcon will respond within 30 (thirty) days after receiving the request, unless a longer period is permitted by applicable law.
17.2.3Auxcon may request reasonable proof of identity before processing your request to prevent unauthorised disclosure.
17.2.4Auxcon will not charge a fee merely to submit a request. A reasonable fee may apply where permitted by law, including for an unfounded or excessive request, or Auxcon may refuse a request where POPIA permits it.
17.3PAIA: Access to records held by Auxcon may also be requested under PAIA. Auxcon’s PAIA manual, compiled under section 51 of PAIA, is available at ww2.auxcon.co.za/paia and on request from the Information Officer. To make a PAIA request, submit the prescribed request form or a written request to the Information Officer using the contact details in this Privacy Policy, identify yourself, describe the record and preferred form of access, and provide proof of identity. Auxcon will make a decision within the period prescribed by PAIA, subject to any lawful extension, notify you in writing, and explain any refusal and available remedies. Applicable request or access fees may apply.
18.DIRECT MARKETING AND CONSENT
18.1In accordance with section 69 of POPIA, Auxcon will use Personal Information for direct marketing by electronic communication only with the Data Subject’s prior, specific and informed opt-in consent.
18.2Auxcon may use electronic communications, including e-mail and WhatsApp, to send marketing material about its own products and services only where:
18.2.1the Data Subject has given separate, specific and informed opt-in consent to receive the communications;
18.2.2the communication clearly identifies Auxcon as the sender;
18.2.3the communication contains a simple and effective opt-out mechanism; and
18.2.4the Data Subject has not withdrawn consent or objected to receiving the communications.
18.3You may withdraw your consent to direct marketing at any time by:
18.3.1clicking the "unsubscribe" link in any marketing e-mail;
18.3.2replying "STOP" to any WhatsApp marketing message; or
18.3.3contacting the Information Officer at leigh-ann@auxcon.co.za.
18.4Withdrawal of marketing consent does not affect the sending of transactional or service-related communications, such as billing notifications, brief confirmations and security alerts.
18.5Auxcon will keep a record of direct-marketing consent and any withdrawal or objection and will stop sending direct marketing as soon as reasonably practicable after receiving the withdrawal or objection.
19.COOKIE POLICY
19.1The Platform uses cookies and similar technologies to support functionality and improve user experience. A cookie is a small text file stored on your device when you visit the Platform.
19.2The following categories of cookies may be used:
| Category | Purpose | Consent Required | How to Manage |
|---|---|---|---|
| Strictly Necessary / Session Cookies | Authentication, session management, security and core Platform functionality. These cookies are essential for the Platform to operate. | No where strictly necessary to provide a service requested by you; otherwise consent may be required. | They cannot be disabled without affecting Platform functionality. |
| Analytics Cookies | To gather usage trends, page views, feature adoption and performance metrics to improve the Platform; data is anonymised or de-identified where reasonably practicable. | Yes (opt-in consent required) | Manage via the cookie consent banner on first visit or via browser settings. Declining does not affect core Platform functionality. |
| Preference Cookies | To remember user preferences such as language, display settings, and dashboard layout. | Yes (opt-in consent required) | Manage via the cookie consent banner or browser settings. Declining may result in default settings being applied. |
19.3Declining non-essential cookies does not affect core Platform functionality. You may delete all cookies through your browser settings at any time.
19.4For more information about cookies, visit www.allaboutcookies.org.
20.AUTOMATED DECISION-MAKING
20.1Auxcon does not currently make decisions based solely on automated processing that produce legal effects concerning Data Subjects or significantly affect them, as contemplated in section 71 of POPIA.
20.2The briefing-filter function on AuxAttorney allows Attorneys to filter available Advocates by criteria such as court or location, field of practice, seniority, gender and race. The function provides filtering results only; it does not make automated decisions on behalf of Attorneys. The ultimate decision to brief a particular Advocate remains with the instructing Attorney.
20.3If Auxcon implements automated decision-making in future, it will inform affected Data Subjects and provide the rights and safeguards required by section 71 of POPIA, including an opportunity to make representations.
21.WHATSAPP BUSINESS API AND META PROCESSING
21.1Auxcon uses the WhatsApp Business API, provided by Meta Platforms Inc. ("Meta"), to send notification messages to Advocates. The following applies:
21.1.1Data processed via WhatsApp: an Advocate's mobile number; message content (outbound pre-approved notification templates and inbound messages and voice notes from Invoice Assistant subscribers); message-delivery metadata, including delivery status and timestamps; and opt-in and opt-out records.
21.1.2Recipient of WhatsApp notifications: Auxcon currently sends WhatsApp notifications only to Advocates. It does not send WhatsApp messages to Attorneys or other Users at this time.
21.1.3Inbound messages: Advocates who subscribe to the Invoice Assistant add-on may send fee narrations, time entries, documents and instructions to Auxcon's practice management team by WhatsApp message or voice note. This content is processed only to deliver the Practice Management Service and is retained as set out in section 16.
21.1.4Meta's processing: Meta Platforms Inc. processes message data in accordance with Meta's own Privacy Policy, available at https://www.facebook.com/privacy/policy/. Auxcon does not control Meta's processing practices and is not responsible for Meta's independent processing.
21.1.5Consent: WhatsApp notifications are sent only to Advocates who have opted in by registering and supplying a mobile number (transactional templates) or by a separate opt-in (marketing). Advocates may opt out at any time by replying "STOP" or contacting the Information Officer.
21.1.6Retention: WhatsApp message logs are retained for 30 days from the message date and then securely deleted; inbound practice management communications are retained as set out in section 16.
22.UPDATES TO THIS PRIVACY POLICY
22.1Auxcon may update this Privacy Policy from time to time to reflect changes in its practices, services or applicable law.
22.2Material updates to this Privacy Policy will take effect not less than 7 (seven) days after publication on Auxcon's Website and will be notified to registered Users by e-mail.
22.3Continued use of the Platform after the effective date of an updated Privacy Policy constitutes acceptance of the updated terms. If you do not agree with a change, you should discontinue use of the Platform.
22.4The current version of this Privacy Policy is always available on the Website at ww2.auxcon.co.za, and previous versions are available from the Information Officer on request.
23.CONTACT AND COMPLAINTS
23.1If you have questions, concerns or complaints about this Privacy Policy or Auxcon's processing of your Personal Information, please contact:
| Detail | Contact |
|---|---|
| Information Officer | Leigh-Ann Fourie · leigh-ann@auxcon.co.za · +27 61 231 4070 |
| Postal Address | 257 Brooklyn Road, Brooklyn, Pretoria, 0181 (Equity Park, Building B, 1st Floor) |
| Support | supports@auxcon.co.za |
23.2Auxcon will investigate and respond to a complaint within 30 (thirty) days after receiving it.
23.3If you are not satisfied with Auxcon's response, you have the right to lodge a complaint with the Information Regulator:
| Detail | Contact |
|---|---|
| Website | www.inforegulator.org.za |
| General enquiries | enquiries@inforegulator.org.za |
| Complaints | POPIAComplaints@inforegulator.org.za |
By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy. Where POPIA requires consent, Auxcon will request it separately.
— End of Privacy Policy —